@robelest/convex-auth 0.0.4-preview.2 → 0.0.4-preview.21

package/src/component/public.ts

@@ -1,1767 +1,27 @@
-import { ConvexError, v } from "convex/values";
-import { mutation, query } from "./functions";
-
-// ============================================================================
-// Tag normalization helpers
-// ============================================================================
-
-/** Validator for a single `{ key, value }` tag pair. */
-const vTag = v.object({ key: v.string(), value: v.string() });
-
-type TagPair = { key: string; value: string };
-
-/** Normalize a single tag: trim + lowercase key and value. */
-function normalizeTag(tag: TagPair): TagPair {
-  return {
-    key: tag.key.trim().toLowerCase(),
-    value: tag.value.trim().toLowerCase(),
-  };
-}
-
 /**
- * Normalize and deduplicate an array of tags.
- * Deduplication is based on the normalized `key\0value` composite.
- */
-function normalizeTags(tags: TagPair[]): TagPair[] {
-  const seen = new Set<string>();
-  const result: TagPair[] = [];
-  for (const raw of tags) {
-    const t = normalizeTag(raw);
-    const composite = `${t.key}\0${t.value}`;
-    if (!seen.has(composite)) {
-      seen.add(composite);
-      result.push(t);
-    }
-  }
-  return result;
-}
-
-// ============================================================================
-// Users
-// ============================================================================
-
-/**
- * List users with optional filtering, sorting, and pagination.
- *
- * Returns `{ items, nextCursor }` — pass `nextCursor` back as `cursor`
- * for the next page, or `null` when exhausted.
- */
-export const userList = query({
-  args: {
-    where: v.optional(
-      v.object({
-        email: v.optional(v.string()),
-        phone: v.optional(v.string()),
-        isAnonymous: v.optional(v.boolean()),
-        name: v.optional(v.string()),
-      }),
-    ),
-    limit: v.optional(v.number()),
-    cursor: v.optional(v.union(v.string(), v.null())),
-    orderBy: v.optional(
-      v.union(
-        v.literal("_creationTime"),
-        v.literal("name"),
-        v.literal("email"),
-        v.literal("phone"),
-      ),
-    ),
-    order: v.optional(v.union(v.literal("asc"), v.literal("desc"))),
-  },
-  handler: async (ctx, args) => {
-    const where = args.where ?? {};
-    const limit = Math.min(Math.max(args.limit ?? 50, 1), 100);
-    const order = args.order ?? "desc";
-
-    // Pick index based on where fields
-    let q;
-    if (where.email !== undefined) {
-      q = ctx.db
-        .query("user")
-        .withIndex("email", (idx) => idx.eq("email", where.email!));
-    } else if (where.phone !== undefined) {
-      q = ctx.db
-        .query("user")
-        .withIndex("phone", (idx) => idx.eq("phone", where.phone!));
-    } else {
-      q = ctx.db.query("user");
-    }
-
-    // Apply remaining filters
-    if (where.isAnonymous !== undefined) {
-      q = q.filter((f) => f.eq(f.field("isAnonymous"), where.isAnonymous!));
-    }
-    if (where.name !== undefined) {
-      q = q.filter((f) => f.eq(f.field("name"), where.name!));
-    }
-    // email/phone filters when not used as index
-    if (where.email !== undefined && where.phone !== undefined) {
-      q = q.filter((f) => f.eq(f.field("phone"), where.phone!));
-    }
-
-    q = q.order(order);
-
-    // Cursor-based pagination: skip past the cursor ID
-    const all = await q.collect();
-    let startIdx = 0;
-    if (args.cursor) {
-      const cursorIdx = all.findIndex((doc) => doc._id === args.cursor);
-      if (cursorIdx !== -1) {
-        startIdx = cursorIdx + 1;
-      }
-    }
-    const page = all.slice(startIdx, startIdx + limit + 1);
-    const hasMore = page.length > limit;
-    const items = hasMore ? page.slice(0, limit) : page;
-    const nextCursor = hasMore ? items[items.length - 1]._id : null;
-    return { items, nextCursor };
-  },
-});
-
-/** Retrieve a user by their document ID. */
-export const userGetById = query({
-  args: { userId: v.id("user") },
-  handler: async (ctx, { userId }) => {
-    return await ctx.db.get(userId);
-  },
-});
-
-/**
- * Find a user by their verified email address. Returns `null` if no user
- * has this email verified, or if multiple users share the same verified email
- * (ambiguous — should not happen in normal operation).
- */
-export const userFindByVerifiedEmail = query({
-  args: { email: v.string() },
-  handler: async (ctx, { email }) => {
-    const users = await ctx.db
-      .query("user")
-      .withIndex("email", (q) => q.eq("email", email))
-      .filter((q) => q.neq(q.field("emailVerificationTime"), undefined))
-      .take(2);
-    return users.length === 1 ? users[0] : null;
-  },
-});
-
-/**
- * Find a user by their verified phone number. Returns `null` if no user
- * has this phone verified, or if multiple users share the same verified phone
- * (ambiguous — should not happen in normal operation).
- */
-export const userFindByVerifiedPhone = query({
-  args: { phone: v.string() },
-  handler: async (ctx, { phone }) => {
-    const users = await ctx.db
-      .query("user")
-      .withIndex("phone", (q) => q.eq("phone", phone))
-      .filter((q) => q.neq(q.field("phoneVerificationTime"), undefined))
-      .take(2);
-    return users.length === 1 ? users[0] : null;
-  },
-});
-
-/** Insert a new user document. */
-export const userInsert = mutation({
-  args: { data: v.any() },
-  handler: async (ctx, { data }) => {
-    return await ctx.db.insert("user", data);
-  },
-});
-
-/** Insert a new user or update an existing one. */
-export const userUpsert = mutation({
-  args: { userId: v.optional(v.id("user")), data: v.any() },
-  handler: async (ctx, { userId, data }) => {
-    if (userId !== undefined) {
-      await ctx.db.patch(userId, data);
-      return userId;
-    }
-    return await ctx.db.insert("user", data);
-  },
-});
-
-/** Patch an existing user document with partial data. */
-export const userPatch = mutation({
-  args: { userId: v.id("user"), data: v.any() },
-  handler: async (ctx, { userId, data }) => {
-    await ctx.db.patch(userId, data);
-  },
-});
-
-// ============================================================================
-// Accounts
-// ============================================================================
-
-/** List all accounts for a user. */
-export const accountListByUser = query({
-  args: { userId: v.id("user") },
-  handler: async (ctx, { userId }) => {
-    return await ctx.db
-      .query("account")
-      .withIndex("userIdAndProvider", (q) => q.eq("userId", userId as any))
-      .collect();
-  },
-});
-
-/** Look up an account by provider and provider-specific account ID. */
-export const accountGet = query({
-  args: { provider: v.string(), providerAccountId: v.string() },
-  handler: async (ctx, { provider, providerAccountId }) => {
-    return await ctx.db
-      .query("account")
-      .withIndex("providerAndAccountId", (q) =>
-        q.eq("provider", provider).eq("providerAccountId", providerAccountId),
-      )
-      .unique();
-  },
-});
-
-/** Retrieve an account by its document ID. */
-export const accountGetById = query({
-  args: { accountId: v.id("account") },
-  handler: async (ctx, { accountId }) => {
-    return await ctx.db.get(accountId);
-  },
-});
-
-/** Create a new account linking a user to an auth provider. */
-export const accountInsert = mutation({
-  args: {
-    userId: v.id("user"),
-    provider: v.string(),
-    providerAccountId: v.string(),
-    secret: v.optional(v.string()),
-  },
-  handler: async (ctx, args) => {
-    return await ctx.db.insert("account", args as any);
-  },
-});
-
-/** Patch an existing account document with partial data. */
-export const accountPatch = mutation({
-  args: { accountId: v.id("account"), data: v.any() },
-  handler: async (ctx, { accountId, data }) => {
-    await ctx.db.patch(accountId, data);
-  },
-});
-
-/** Delete an account document. */
-export const accountDelete = mutation({
-  args: { accountId: v.id("account") },
-  handler: async (ctx, { accountId }) => {
-    await ctx.db.delete(accountId);
-  },
-});
-
-// ============================================================================
-// Sessions
-// ============================================================================
-
-/**
- * List sessions with optional filtering and pagination.
- *
- * Returns `{ items, nextCursor }`.
- */
-export const sessionList = query({
-  args: {
-    where: v.optional(
-      v.object({
-        userId: v.optional(v.id("user")),
-      }),
-    ),
-    limit: v.optional(v.number()),
-    cursor: v.optional(v.union(v.string(), v.null())),
-    order: v.optional(v.union(v.literal("asc"), v.literal("desc"))),
-  },
-  handler: async (ctx, args) => {
-    const where = args.where ?? {};
-    const limit = Math.min(Math.max(args.limit ?? 50, 1), 100);
-    const order = args.order ?? "desc";
-
-    let q;
-    if (where.userId !== undefined) {
-      q = ctx.db
-        .query("session")
-        .withIndex("userId", (idx) => idx.eq("userId", where.userId!));
-    } else {
-      q = ctx.db.query("session");
-    }
-
-    q = q.order(order);
-
-    const all = await q.collect();
-    let startIdx = 0;
-    if (args.cursor) {
-      const cursorIdx = all.findIndex((doc) => doc._id === args.cursor);
-      if (cursorIdx !== -1) {
-        startIdx = cursorIdx + 1;
-      }
-    }
-    const page = all.slice(startIdx, startIdx + limit + 1);
-    const hasMore = page.length > limit;
-    const items = hasMore ? page.slice(0, limit) : page;
-    const nextCursor = hasMore ? items[items.length - 1]._id : null;
-    return { items, nextCursor };
-  },
-});
-
-/** Create a new session for a user with an expiration time. */
-export const sessionCreate = mutation({
-  args: { userId: v.id("user"), expirationTime: v.number() },
-  handler: async (ctx, { userId, expirationTime }) => {
-    return await ctx.db.insert("session", {
-      userId: userId as any,
-      expirationTime,
-    });
-  },
-});
-
-/** Retrieve a session by its document ID. */
-export const sessionGetById = query({
-  args: { sessionId: v.id("session") },
-  handler: async (ctx, { sessionId }) => {
-    return await ctx.db.get(sessionId);
-  },
-});
-
-/** Delete a session. No-op if the session does not exist. */
-export const sessionDelete = mutation({
-  args: { sessionId: v.id("session") },
-  handler: async (ctx, { sessionId }) => {
-    if ((await ctx.db.get(sessionId)) !== null) {
-      await ctx.db.delete(sessionId);
-    }
-  },
-});
-
-/** List all sessions for a user. */
-export const sessionListByUser = query({
-  args: { userId: v.id("user") },
-  handler: async (ctx, { userId }) => {
-    return await ctx.db
-      .query("session")
-      .withIndex("userId", (q) => q.eq("userId", userId as any))
-      .collect();
-  },
-});
-
-// ============================================================================
-// Verifiers
-// ============================================================================
-
-/** Create a new PKCE verifier, optionally linked to a session. */
-export const verifierCreate = mutation({
-  args: { sessionId: v.optional(v.id("session")) },
-  handler: async (ctx, { sessionId }) => {
-    return await ctx.db.insert("verifier", { sessionId: sessionId as any });
-  },
-});
-
-/** Retrieve a verifier by its document ID. */
-export const verifierGetById = query({
-  args: { verifierId: v.id("verifier") },
-  handler: async (ctx, { verifierId }) => {
-    return await ctx.db.get(verifierId);
-  },
-});
-
-/** Look up a verifier by its cryptographic signature. */
-export const verifierGetBySignature = query({
-  args: { signature: v.string() },
-  handler: async (ctx, { signature }) => {
-    return await ctx.db
-      .query("verifier")
-      .withIndex("signature", (q) => q.eq("signature", signature))
-      .unique();
-  },
-});
-
-/** Patch a verifier document with partial data. */
-export const verifierPatch = mutation({
-  args: { verifierId: v.id("verifier"), data: v.any() },
-  handler: async (ctx, { verifierId, data }) => {
-    await ctx.db.patch(verifierId, data);
-  },
-});
-
-/** Delete a verifier document. */
-export const verifierDelete = mutation({
-  args: { verifierId: v.id("verifier") },
-  handler: async (ctx, { verifierId }) => {
-    await ctx.db.delete(verifierId);
-  },
-});
-
-// ============================================================================
-// Verification Codes
-// ============================================================================
-
-/** Find a verification code by its associated account ID. */
-export const verificationCodeGetByAccountId = query({
-  args: { accountId: v.id("account") },
-  handler: async (ctx, { accountId }) => {
-    return await ctx.db
-      .query("verification")
-      .withIndex("accountId", (q) => q.eq("accountId", accountId as any))
-      .unique();
-  },
-});
-
-/** Find a verification code by its code string. */
-export const verificationCodeGetByCode = query({
-  args: { code: v.string() },
-  handler: async (ctx, { code }) => {
-    return await ctx.db
-      .query("verification")
-      .withIndex("code", (q) => q.eq("code", code))
-      .unique();
-  },
-});
-
-/** Create a new verification code for OTP, magic link, or OAuth flows. */
-export const verificationCodeCreate = mutation({
-  args: {
-    accountId: v.id("account"),
-    provider: v.string(),
-    code: v.string(),
-    expirationTime: v.number(),
-    verifier: v.optional(v.string()),
-    emailVerified: v.optional(v.string()),
-    phoneVerified: v.optional(v.string()),
-  },
-  handler: async (ctx, args) => {
-    return await ctx.db.insert("verification", args as any);
-  },
-});
-
-/** Delete a verification code document. */
-export const verificationCodeDelete = mutation({
-  args: { verificationCodeId: v.id("verification") },
-  handler: async (ctx, { verificationCodeId }) => {
-    await ctx.db.delete(verificationCodeId);
-  },
-});
-
-// ============================================================================
-// Refresh Tokens
-// ============================================================================
-
-/** Create a new refresh token for a session. */
-export const refreshTokenCreate = mutation({
-  args: {
-    sessionId: v.id("session"),
-    expirationTime: v.number(),
-    parentRefreshTokenId: v.optional(v.id("token")),
-  },
-  handler: async (ctx, args) => {
-    return await ctx.db.insert("token", args as any);
-  },
-});
-
-/** Retrieve a refresh token by its document ID. */
-export const refreshTokenGetById = query({
-  args: { refreshTokenId: v.id("token") },
-  handler: async (ctx, { refreshTokenId }) => {
-    return await ctx.db.get(refreshTokenId);
-  },
-});
-
-/** Patch a refresh token document with partial data. */
-export const refreshTokenPatch = mutation({
-  args: { refreshTokenId: v.id("token"), data: v.any() },
-  handler: async (ctx, { refreshTokenId, data }) => {
-    await ctx.db.patch(refreshTokenId, data);
-  },
-});
-
-/** Get child tokens that were created by exchanging a specific parent token. */
-export const refreshTokenGetChildren = query({
-  args: {
-    sessionId: v.id("session"),
-    parentRefreshTokenId: v.id("token"),
-  },
-  handler: async (ctx, { sessionId, parentRefreshTokenId }) => {
-    return await ctx.db
-      .query("token")
-      .withIndex("sessionIdAndParentRefreshTokenId", (q) =>
-        q
-          .eq("sessionId", sessionId as any)
-          .eq("parentRefreshTokenId", parentRefreshTokenId as any),
-      )
-      .collect();
-  },
-});
-
-/** List all refresh tokens for a session. */
-export const refreshTokenListBySession = query({
-  args: { sessionId: v.id("session") },
-  handler: async (ctx, { sessionId }) => {
-    return await ctx.db
-      .query("token")
-      .withIndex("sessionIdAndParentRefreshTokenId", (q) =>
-        q.eq("sessionId", sessionId as any),
-      )
-      .collect();
-  },
-});
-
-/** Delete all refresh tokens for a session. */
-export const refreshTokenDeleteAll = mutation({
-  args: { sessionId: v.id("session") },
-  handler: async (ctx, { sessionId }) => {
-    const tokens = await ctx.db
-      .query("token")
-      .withIndex("sessionIdAndParentRefreshTokenId", (q) =>
-        q.eq("sessionId", sessionId as any),
-      )
-      .collect();
-    await Promise.all(tokens.map((token) => ctx.db.delete(token._id)));
-  },
-});
-
-/** Get the active (unused) refresh token for a session. */
-export const refreshTokenGetActive = query({
-  args: { sessionId: v.id("session") },
-  handler: async (ctx, { sessionId }) => {
-    return await ctx.db
-      .query("token")
-      .withIndex("sessionId", (q) => q.eq("sessionId", sessionId as any))
-      .filter((q) => q.eq(q.field("firstUsedTime"), undefined))
-      .order("desc")
-      .first();
-  },
-});
-
-// ============================================================================
-// Passkeys
-// ============================================================================
-
-/** Store a new passkey credential for a user. */
-export const passkeyInsert = mutation({
-  args: {
-    userId: v.id("user"),
-    credentialId: v.string(),
-    publicKey: v.bytes(),
-    algorithm: v.number(),
-    counter: v.number(),
-    transports: v.optional(v.array(v.string())),
-    deviceType: v.string(),
-    backedUp: v.boolean(),
-    name: v.optional(v.string()),
-    createdAt: v.number(),
-  },
-  handler: async (ctx, args) => {
-    return await ctx.db.insert("passkey", args);
-  },
-});
-
-/** Look up a passkey by its credential ID. */
-export const passkeyGetByCredentialId = query({
-  args: { credentialId: v.string() },
-  handler: async (ctx, { credentialId }) => {
-    return await ctx.db
-      .query("passkey")
-      .withIndex("credentialId", (q) => q.eq("credentialId", credentialId))
-      .unique();
-  },
-});
-
-/** List all passkeys for a user. */
-export const passkeyListByUserId = query({
-  args: { userId: v.id("user") },
-  handler: async (ctx, { userId }) => {
-    return await ctx.db
-      .query("passkey")
-      .withIndex("userId", (q) => q.eq("userId", userId))
-      .collect();
-  },
-});
-
-/** Update a passkey's counter and last used timestamp after authentication. */
-export const passkeyUpdateCounter = mutation({
-  args: { passkeyId: v.id("passkey"), counter: v.number(), lastUsedAt: v.number() },
-  handler: async (ctx, { passkeyId, counter, lastUsedAt }) => {
-    await ctx.db.patch(passkeyId, { counter, lastUsedAt });
-  },
-});
-
-/** Update a passkey's metadata (name). */
-export const passkeyUpdateMeta = mutation({
-  args: { passkeyId: v.id("passkey"), data: v.any() },
-  handler: async (ctx, { passkeyId, data }) => {
-    await ctx.db.patch(passkeyId, data);
-  },
-});
-
-/** Delete a passkey credential. */
-export const passkeyDelete = mutation({
-  args: { passkeyId: v.id("passkey") },
-  handler: async (ctx, { passkeyId }) => {
-    await ctx.db.delete(passkeyId);
-  },
-});
-
-// ============================================================================
-// TOTP Two-Factor Authentication
-// ============================================================================
-
-/** Store a new TOTP enrollment for a user. */
-export const totpInsert = mutation({
-  args: {
-    userId: v.id("user"),
-    secret: v.bytes(),
-    digits: v.number(),
-    period: v.number(),
-    verified: v.boolean(),
-    name: v.optional(v.string()),
-    createdAt: v.number(),
-  },
-  handler: async (ctx, args) => {
-    return await ctx.db.insert("totp", args);
-  },
-});
-
-/** Get a verified TOTP enrollment for a user (returns first match). */
-export const totpGetVerifiedByUserId = query({
-  args: { userId: v.id("user") },
-  handler: async (ctx, { userId }) => {
-    return await ctx.db
-      .query("totp")
-      .withIndex("userId", (q) => q.eq("userId", userId))
-      .filter((q) => q.eq(q.field("verified"), true))
-      .first();
-  },
-});
-
-/** List all TOTP enrollments for a user. */
-export const totpListByUserId = query({
-  args: { userId: v.id("user") },
-  handler: async (ctx, { userId }) => {
-    return await ctx.db
-      .query("totp")
-      .withIndex("userId", (q) => q.eq("userId", userId))
-      .collect();
-  },
-});
-
-/** Get a TOTP enrollment by its ID. */
-export const totpGetById = query({
-  args: { totpId: v.id("totp") },
-  handler: async (ctx, { totpId }) => {
-    return await ctx.db.get(totpId);
-  },
-});
-
-/** Mark a TOTP enrollment as verified (setup complete). */
-export const totpMarkVerified = mutation({
-  args: { totpId: v.id("totp"), lastUsedAt: v.number() },
-  handler: async (ctx, { totpId, lastUsedAt }) => {
-    await ctx.db.patch(totpId, { verified: true, lastUsedAt });
-  },
-});
-
-/** Update a TOTP enrollment's last used timestamp. */
-export const totpUpdateLastUsed = mutation({
-  args: { totpId: v.id("totp"), lastUsedAt: v.number() },
-  handler: async (ctx, { totpId, lastUsedAt }) => {
-    await ctx.db.patch(totpId, { lastUsedAt });
-  },
-});
-
-/** Delete a TOTP enrollment. */
-export const totpDelete = mutation({
-  args: { totpId: v.id("totp") },
-  handler: async (ctx, { totpId }) => {
-    await ctx.db.delete(totpId);
-  },
-});
-
-// ============================================================================
-// Rate Limits
-// ============================================================================
-
-/** Look up a rate limit entry by its identifier. */
-export const rateLimitGet = query({
-  args: { identifier: v.string() },
-  handler: async (ctx, { identifier }) => {
-    return await ctx.db
-      .query("limit")
-      .withIndex("identifier", (q) => q.eq("identifier", identifier))
-      .unique();
-  },
-});
-
-/** Create a new rate limit entry. */
-export const rateLimitCreate = mutation({
-  args: {
-    identifier: v.string(),
-    attemptsLeft: v.number(),
-    lastAttemptTime: v.number(),
-  },
-  handler: async (ctx, args) => {
-    return await ctx.db.insert("limit", args);
-  },
-});
-
-/** Patch a rate limit entry with partial data. */
-export const rateLimitPatch = mutation({
-  args: { rateLimitId: v.id("limit"), data: v.any() },
-  handler: async (ctx, { rateLimitId, data }) => {
-    await ctx.db.patch(rateLimitId, data);
-  },
-});
-
-/** Delete a rate limit entry. */
-export const rateLimitDelete = mutation({
-  args: { rateLimitId: v.id("limit") },
-  handler: async (ctx, { rateLimitId }) => {
-    await ctx.db.delete(rateLimitId);
-  },
-});
-
-// ============================================================================
-// Groups
-// ============================================================================
-
-/**
- * Create a new group. Groups are hierarchical — set `parentGroupId` to nest
- * under an existing group, or omit it to create a root-level group.
- *
- * @returns The ID of the newly created group.
- */
-export const groupCreate = mutation({
-  args: {
-    name: v.string(),
-    slug: v.optional(v.string()),
-    type: v.optional(v.string()),
-    parentGroupId: v.optional(v.id("group")),
-    tags: v.optional(v.array(vTag)),
-    extend: v.optional(v.any()),
-  },
-  handler: async (ctx, args) => {
-    const { tags: rawTags, ...rest } = args;
-    const normalizedTags = rawTags ? normalizeTags(rawTags) : undefined;
-    const groupId = await ctx.db.insert("group", {
-      ...rest,
-      tags: normalizedTags,
-    });
-    // Sync companion groupTag rows
-    if (normalizedTags) {
-      for (const tag of normalizedTags) {
-        await ctx.db.insert("groupTag", {
-          groupId,
-          key: tag.key,
-          value: tag.value,
-        });
-      }
-    }
-    return groupId;
-  },
-});
-
-/** Retrieve a group by its document ID. Returns `null` if not found. */
-export const groupGet = query({
-  args: { groupId: v.id("group") },
-  handler: async (ctx, { groupId }) => {
-    return await ctx.db.get(groupId);
-  },
-});
-
-/**
- * List groups with optional filtering, sorting, and pagination.
- *
- * Returns `{ items, nextCursor }`. Empty `where` returns **all** groups.
- */
-export const groupList = query({
-  args: {
-    where: v.optional(
-      v.object({
-        slug: v.optional(v.string()),
-        type: v.optional(v.string()),
-        parentGroupId: v.optional(v.id("group")),
-        name: v.optional(v.string()),
-        isRoot: v.optional(v.boolean()),
-        tagsAll: v.optional(v.array(vTag)),
-        tagsAny: v.optional(v.array(vTag)),
-      }),
-    ),
-    limit: v.optional(v.number()),
-    cursor: v.optional(v.union(v.string(), v.null())),
-    orderBy: v.optional(
-      v.union(
-        v.literal("_creationTime"),
-        v.literal("name"),
-        v.literal("slug"),
-        v.literal("type"),
-      ),
-    ),
-    order: v.optional(v.union(v.literal("asc"), v.literal("desc"))),
-  },
-  handler: async (ctx, args) => {
-    const where = args.where ?? {};
-    const limit = Math.min(Math.max(args.limit ?? 50, 1), 100);
-    const order = args.order ?? "desc";
-
-    // ---- Resolve tag filters into a Set<Id<"group">> ----
-    let tagFilteredIds: Set<string> | null = null;
-
-    if (where.tagsAll && where.tagsAll.length > 0) {
-      // Intersect: group must have ALL specified tags
-      let allSet: Set<string> | null = null;
-      for (const rawTag of where.tagsAll) {
-        const t = normalizeTag(rawTag);
-        const rows = await ctx.db
-          .query("groupTag")
-          .withIndex("by_key_value", (idx) =>
-            idx.eq("key", t.key).eq("value", t.value),
-          )
-          .collect();
-        const ids = new Set(rows.map((r) => r.groupId as string));
-        if (allSet === null) {
-          allSet = ids;
-        } else {
-          // Intersect
-          for (const id of allSet) {
-            if (!ids.has(id)) allSet.delete(id);
-          }
-        }
-        // Short-circuit: empty intersection
-        if (allSet.size === 0) break;
-      }
-      tagFilteredIds = allSet ?? new Set();
-    }
-
-    if (where.tagsAny && where.tagsAny.length > 0) {
-      // Union: group must have at least one of the specified tags
-      const anySet = new Set<string>();
-      for (const rawTag of where.tagsAny) {
-        const t = normalizeTag(rawTag);
-        const rows = await ctx.db
-          .query("groupTag")
-          .withIndex("by_key_value", (idx) =>
-            idx.eq("key", t.key).eq("value", t.value),
-          )
-          .collect();
-        for (const r of rows) {
-          anySet.add(r.groupId as string);
-        }
-      }
-      if (tagFilteredIds !== null) {
-        // AND with tagsAll result
-        for (const id of tagFilteredIds) {
-          if (!anySet.has(id)) tagFilteredIds.delete(id);
-        }
-      } else {
-        tagFilteredIds = anySet;
-      }
-    }
-
-    // ---- Pick best index based on non-tag where fields ----
-    let q;
-    if (where.type !== undefined && where.parentGroupId !== undefined) {
-      q = ctx.db
-        .query("group")
-        .withIndex("typeAndParentGroupId", (idx) =>
-          idx.eq("type", where.type!).eq("parentGroupId", where.parentGroupId!),
-        );
-    } else if (where.slug !== undefined) {
-      q = ctx.db
-        .query("group")
-        .withIndex("slug", (idx) => idx.eq("slug", where.slug!));
-    } else if (where.type !== undefined) {
-      q = ctx.db
-        .query("group")
-        .withIndex("type", (idx) => idx.eq("type", where.type!));
-    } else if (where.parentGroupId !== undefined) {
-      q = ctx.db
-        .query("group")
-        .withIndex("parentGroupId", (idx) =>
-          idx.eq("parentGroupId", where.parentGroupId!),
-        );
-    } else {
-      q = ctx.db.query("group");
-    }
-
-    // Apply remaining non-tag filters not covered by index
-    if (where.name !== undefined) {
-      q = q.filter((f) => f.eq(f.field("name"), where.name!));
-    }
-    if (where.isRoot === true) {
-      q = q.filter((f) => f.eq(f.field("parentGroupId"), undefined));
-    } else if (where.isRoot === false) {
-      q = q.filter((f) => f.neq(f.field("parentGroupId"), undefined));
-    }
-    // slug filter when not used as index
-    if (where.slug !== undefined && where.type !== undefined) {
-      q = q.filter((f) => f.eq(f.field("slug"), where.slug!));
-    }
-
-    q = q.order(order);
-
-    let all = await q.collect();
-
-    // Apply tag filter (intersect with resolved groupIds)
-    if (tagFilteredIds !== null) {
-      all = all.filter((doc) => tagFilteredIds!.has(doc._id as string));
-    }
-
-    // Cursor-based pagination
-    let startIdx = 0;
-    if (args.cursor) {
-      const cursorIdx = all.findIndex((doc) => doc._id === args.cursor);
-      if (cursorIdx !== -1) {
-        startIdx = cursorIdx + 1;
-      }
-    }
-    const page = all.slice(startIdx, startIdx + limit + 1);
-    const hasMore = page.length > limit;
-    const items = hasMore ? page.slice(0, limit) : page;
-    const nextCursor = hasMore ? items[items.length - 1]._id : null;
-    return { items, nextCursor };
-  },
-});
-
-/** Update a group's fields (name, slug, tags, extend, parentGroupId). */
-export const groupUpdate = mutation({
-  args: { groupId: v.id("group"), data: v.any() },
-  handler: async (ctx, { groupId, data }) => {
-    // If tags are being updated, normalize and replace the full tag set
-    if (data.tags !== undefined) {
-      const normalizedTags: TagPair[] = Array.isArray(data.tags)
-        ? normalizeTags(data.tags as TagPair[])
-        : [];
-      // Delete existing groupTag rows for this group
-      const existingTags = await ctx.db
-        .query("groupTag")
-        .withIndex("by_group", (idx) => idx.eq("groupId", groupId))
-        .collect();
-      for (const existing of existingTags) {
-        await ctx.db.delete(existing._id);
-      }
-      // Insert new normalized groupTag rows
-      for (const tag of normalizedTags) {
-        await ctx.db.insert("groupTag", {
-          groupId,
-          key: tag.key,
-          value: tag.value,
-        });
-      }
-      // Patch group with normalized tags (empty array = clear all)
-      await ctx.db.patch(groupId, {
-        ...data,
-        tags: normalizedTags.length > 0 ? normalizedTags : undefined,
-      });
-    } else {
-      await ctx.db.patch(groupId, data);
-    }
-  },
-});
-
-/**
- * Delete a group and all of its descendants. This cascades to:
- * - All child groups (recursively)
- * - All members of this group and its descendants
- * - All invites for this group and its descendants
- */
-export const groupDelete = mutation({
-  args: { groupId: v.id("group") },
-  handler: async (ctx, { groupId }) => {
-    const deleteGroup = async (id: typeof groupId) => {
-      const children = await ctx.db
-        .query("group")
-        .withIndex("parentGroupId", (q) => q.eq("parentGroupId", id))
-        .collect();
-      for (const child of children) {
-        await deleteGroup(child._id);
-      }
-
-      const members = await ctx.db
-        .query("member")
-        .withIndex("groupId", (q) => q.eq("groupId", id))
-        .collect();
-      for (const member of members) {
-        await ctx.db.delete(member._id);
-      }
-
-      const invites = await ctx.db
-        .query("invite")
-        .withIndex("groupId", (q) => q.eq("groupId", id))
-        .collect();
-      for (const invite of invites) {
-        await ctx.db.delete(invite._id);
-      }
-
-      // Delete companion groupTag rows
-      const tags = await ctx.db
-        .query("groupTag")
-        .withIndex("by_group", (q) => q.eq("groupId", id))
-        .collect();
-      for (const tag of tags) {
-        await ctx.db.delete(tag._id);
-      }
-
-      await ctx.db.delete(id);
-    };
-
-    await deleteGroup(groupId);
-  },
-});
-
-// ============================================================================
-// Members
-// ============================================================================
-
-/**
- * Add a user as a member of a group.
- *
- * The `role` field is an application-defined string (e.g. "owner", "admin",
- * "member", "viewer"). The auth component stores it but does not enforce
- * access control — your application defines what each role means.
- *
- * Throws `ConvexError` with code `DUPLICATE_MEMBERSHIP` when the user is
- * already a member of the target group.
- *
- * @returns The ID of the new member record.
- */
-export const memberAdd = mutation({
-  args: {
-    groupId: v.id("group"),
-    userId: v.id("user"),
-    role: v.optional(v.string()),
-    status: v.optional(v.string()),
-    extend: v.optional(v.any()),
-  },
-  handler: async (ctx, args) => {
-    const existingMembership = await ctx.db
-      .query("member")
-      .withIndex("groupIdAndUserId", (q) =>
-        q.eq("groupId", args.groupId).eq("userId", args.userId),
-      )
-      .unique();
-    if (existingMembership !== null) {
-      throw new ConvexError({
-        code: "DUPLICATE_MEMBERSHIP",
-        message: "User is already a member of this group",
-        groupId: args.groupId,
-        userId: args.userId,
-        existingMemberId: existingMembership._id,
-      });
-    }
-    return await ctx.db.insert("member", args);
-  },
-});
-
-/** Retrieve a member record by its document ID. Returns `null` if not found. */
-export const memberGet = query({
-  args: { memberId: v.id("member") },
-  handler: async (ctx, { memberId }) => {
-    return await ctx.db.get(memberId);
-  },
-});
-
-/**
- * List members with optional filtering, sorting, and pagination.
- *
- * Returns `{ items, nextCursor }`. Supports filtering by `groupId`,
- * `userId`, `role`, and `status`.
- */
-export const memberList = query({
-  args: {
-    where: v.optional(
-      v.object({
-        groupId: v.optional(v.id("group")),
-        userId: v.optional(v.id("user")),
-        role: v.optional(v.string()),
-        status: v.optional(v.string()),
-      }),
-    ),
-    limit: v.optional(v.number()),
-    cursor: v.optional(v.union(v.string(), v.null())),
-    orderBy: v.optional(
-      v.union(
-        v.literal("_creationTime"),
-        v.literal("role"),
-        v.literal("status"),
-      ),
-    ),
-    order: v.optional(v.union(v.literal("asc"), v.literal("desc"))),
-  },
-  handler: async (ctx, args) => {
-    const where = args.where ?? {};
-    const limit = Math.min(Math.max(args.limit ?? 50, 1), 100);
-    const order = args.order ?? "desc";
-
-    let q;
-    if (where.groupId !== undefined && where.userId !== undefined) {
-      q = ctx.db
-        .query("member")
-        .withIndex("groupIdAndUserId", (idx) =>
-          idx.eq("groupId", where.groupId!).eq("userId", where.userId!),
-        );
-    } else if (where.groupId !== undefined) {
-      q = ctx.db
-        .query("member")
-        .withIndex("groupId", (idx) => idx.eq("groupId", where.groupId!));
-    } else if (where.userId !== undefined) {
-      q = ctx.db
-        .query("member")
-        .withIndex("userId", (idx) => idx.eq("userId", where.userId!));
-    } else {
-      q = ctx.db.query("member");
-    }
-
-    if (where.role !== undefined) {
-      q = q.filter((f) => f.eq(f.field("role"), where.role!));
-    }
-    if (where.status !== undefined) {
-      q = q.filter((f) => f.eq(f.field("status"), where.status!));
-    }
-
-    q = q.order(order);
-
-    const all = await q.collect();
-    let startIdx = 0;
-    if (args.cursor) {
-      const cursorIdx = all.findIndex((doc) => doc._id === args.cursor);
-      if (cursorIdx !== -1) {
-        startIdx = cursorIdx + 1;
-      }
-    }
-    const page = all.slice(startIdx, startIdx + limit + 1);
-    const hasMore = page.length > limit;
-    const items = hasMore ? page.slice(0, limit) : page;
-    const nextCursor = hasMore ? items[items.length - 1]._id : null;
-    return { items, nextCursor };
-  },
-});
-
-/**
- * @deprecated Use `memberList` with `where: { userId }` instead.
- * Kept for backward compatibility with generated component types.
- */
-export const memberListByUser = query({
-  args: { userId: v.id("user") },
-  handler: async (ctx, { userId }) => {
-    return await ctx.db
-      .query("member")
-      .withIndex("userId", (q) => q.eq("userId", userId))
-      .collect();
-  },
-});
-
-/**
- * Look up a specific user's membership in a specific group.
- * Returns `null` if the user is not a member of the group.
- */
-export const memberGetByGroupAndUser = query({
-  args: { groupId: v.id("group"), userId: v.id("user") },
-  handler: async (ctx, { groupId, userId }) => {
-    return await ctx.db
-      .query("member")
-      .withIndex("groupIdAndUserId", (q) =>
-        q.eq("groupId", groupId).eq("userId", userId),
-      )
-      .unique();
-  },
-});
-
-/** Remove a member from a group by deleting the member record. */
-export const memberRemove = mutation({
-  args: { memberId: v.id("member") },
-  handler: async (ctx, { memberId }) => {
-    await ctx.db.delete(memberId);
-  },
-});
-
-/**
- * Update a member record's fields (role, status, extend).
- *
- * Common usage: `memberUpdate({ memberId, data: { role: "admin" } })`
- */
-export const memberUpdate = mutation({
-  args: { memberId: v.id("member"), data: v.any() },
-  handler: async (ctx, { memberId, data }) => {
-    await ctx.db.patch(memberId, data);
-  },
-});
-
-// ============================================================================
-// Invites
-// ============================================================================
-
-/**
- * Create a new platform-level invitation. Optionally set `groupId` to tie
- * the invite to a specific group. The invitation is sent to an email address
- * and includes a hashed token for secure acceptance.
- *
- * Throws `ConvexError` with code `DUPLICATE_INVITE` when a pending invite
- * already exists for the same email and scope:
- * - group invite: same `email` + same `groupId`
- * - platform invite: same `email` with no `groupId`
- *
- * @returns The ID of the new invite record.
- */
-export const inviteCreate = mutation({
-  args: {
-    groupId: v.optional(v.id("group")),
-    invitedByUserId: v.optional(v.id("user")),
-    email: v.optional(v.string()),
-    tokenHash: v.string(),
-    role: v.optional(v.string()),
-    status: v.union(
-      v.literal("pending"),
-      v.literal("accepted"),
-      v.literal("revoked"),
-      v.literal("expired"),
-    ),
-    expiresTime: v.optional(v.number()),
-    extend: v.optional(v.any()),
-  },
-  handler: async (ctx, args) => {
-    // Only check for duplicates when an email is provided.
-    // CLI-generated invites (no email) are always allowed.
-    if (args.email !== undefined) {
-      if (args.groupId !== undefined) {
-        const existingGroupInvite = await ctx.db
-          .query("invite")
-          .withIndex("groupIdAndStatus", (q) =>
-            q.eq("groupId", args.groupId).eq("status", "pending"),
-          )
-          .filter((q) => q.eq(q.field("email"), args.email))
-          .first();
-        if (existingGroupInvite !== null) {
-          throw new ConvexError({
-            code: "DUPLICATE_INVITE",
-            message:
-              "A pending invite already exists for this email in this group",
-            email: args.email,
-            groupId: args.groupId,
-            existingInviteId: existingGroupInvite._id,
-          });
-        }
-      } else {
-        const existingPlatformInvite = await ctx.db
-          .query("invite")
-          .withIndex("emailAndStatus", (q) =>
-            q.eq("email", args.email).eq("status", "pending"),
-          )
-          .filter((q) => q.eq(q.field("groupId"), undefined))
-          .first();
-        if (existingPlatformInvite !== null) {
-          throw new ConvexError({
-            code: "DUPLICATE_INVITE",
-            message:
-              "A pending platform invite already exists for this email",
-            email: args.email,
-            existingInviteId: existingPlatformInvite._id,
-          });
-        }
-      }
-    }
-    return await ctx.db.insert("invite", args);
-  },
-});
-
-/** Retrieve an invite by its document ID. Returns `null` if not found. */
-export const inviteGet = query({
-  args: { inviteId: v.id("invite") },
-  handler: async (ctx, { inviteId }) => {
-    return await ctx.db.get(inviteId);
-  },
-});
-
-/**
- * List invites with optional filtering, sorting, and pagination.
- *
- * Returns `{ items, nextCursor }`. Supports filtering by `groupId`,
- * `status`, `email`, `invitedByUserId`, `role`, `acceptedByUserId`, and `tokenHash`.
- */
-export const inviteList = query({
-  args: {
-    where: v.optional(
-      v.object({
-        tokenHash: v.optional(v.string()),
-        groupId: v.optional(v.id("group")),
-        status: v.optional(
-          v.union(
-            v.literal("pending"),
-            v.literal("accepted"),
-            v.literal("revoked"),
-            v.literal("expired"),
-          ),
-        ),
-        email: v.optional(v.string()),
-        invitedByUserId: v.optional(v.id("user")),
-        role: v.optional(v.string()),
-        acceptedByUserId: v.optional(v.id("user")),
-      }),
-    ),
-    limit: v.optional(v.number()),
-    cursor: v.optional(v.union(v.string(), v.null())),
-    orderBy: v.optional(
-      v.union(
-        v.literal("_creationTime"),
-        v.literal("status"),
-        v.literal("email"),
-        v.literal("expiresTime"),
-        v.literal("acceptedTime"),
-      ),
-    ),
-    order: v.optional(v.union(v.literal("asc"), v.literal("desc"))),
-  },
-  handler: async (ctx, args) => {
-    const where = args.where ?? {};
-    const limit = Math.min(Math.max(args.limit ?? 50, 1), 100);
-    const order = args.order ?? "desc";
-
-    // Pick best index
-    let q;
-    if (where.tokenHash !== undefined) {
-      q = ctx.db
-        .query("invite")
-        .withIndex("tokenHash", (idx) => idx.eq("tokenHash", where.tokenHash!));
-    } else if (
-      where.role !== undefined &&
-      where.status !== undefined &&
-      where.acceptedByUserId !== undefined
-    ) {
-      q = ctx.db
-        .query("invite")
-        .withIndex("roleAndStatusAndAcceptedByUserId", (idx) =>
-          idx
-            .eq("role", where.role!)
-            .eq("status", where.status!)
-            .eq("acceptedByUserId", where.acceptedByUserId!),
-        );
-    } else if (where.groupId !== undefined && where.status !== undefined) {
-      q = ctx.db
-        .query("invite")
-        .withIndex("groupIdAndStatus", (idx) =>
-          idx.eq("groupId", where.groupId!).eq("status", where.status!),
-        );
-    } else if (where.email !== undefined && where.status !== undefined) {
-      q = ctx.db
-        .query("invite")
-        .withIndex("emailAndStatus", (idx) =>
-          idx.eq("email", where.email!).eq("status", where.status!),
-        );
-    } else if (where.invitedByUserId !== undefined && where.status !== undefined) {
-      q = ctx.db
-        .query("invite")
-        .withIndex("invitedByUserIdAndStatus", (idx) =>
-          idx
-            .eq("invitedByUserId", where.invitedByUserId!)
-            .eq("status", where.status!),
-        );
-    } else if (where.groupId !== undefined) {
-      q = ctx.db
-        .query("invite")
-        .withIndex("groupId", (idx) => idx.eq("groupId", where.groupId!));
-    } else if (where.status !== undefined) {
-      q = ctx.db
-        .query("invite")
-        .withIndex("status", (idx) => idx.eq("status", where.status!));
-    } else {
-      q = ctx.db.query("invite");
-    }
-
-    // Apply remaining filters
-    if (where.groupId !== undefined) {
-      q = q.filter((f) => f.eq(f.field("groupId"), where.groupId!));
-    }
-    if (where.status !== undefined) {
-      q = q.filter((f) => f.eq(f.field("status"), where.status!));
-    }
-    if (where.email !== undefined) {
-      q = q.filter((f) => f.eq(f.field("email"), where.email!));
-    }
-    if (where.invitedByUserId !== undefined) {
-      q = q.filter((f) =>
-        f.eq(f.field("invitedByUserId"), where.invitedByUserId!),
-      );
-    }
-    if (where.role !== undefined) {
-      q = q.filter((f) => f.eq(f.field("role"), where.role!));
-    }
-    if (where.acceptedByUserId !== undefined) {
-      q = q.filter((f) =>
-        f.eq(f.field("acceptedByUserId"), where.acceptedByUserId!),
-      );
-    }
-    if (where.tokenHash !== undefined) {
-      q = q.filter((f) => f.eq(f.field("tokenHash"), where.tokenHash!));
-    }
-
-    q = q.order(order);
-
-    const all = await q.collect();
-    let startIdx = 0;
-    if (args.cursor) {
-      const cursorIdx = all.findIndex((doc) => doc._id === args.cursor);
-      if (cursorIdx !== -1) {
-        startIdx = cursorIdx + 1;
-      }
-    }
-    const page = all.slice(startIdx, startIdx + limit + 1);
-    const hasMore = page.length > limit;
-    const items = hasMore ? page.slice(0, limit) : page;
-    const nextCursor = hasMore ? items[items.length - 1]._id : null;
-    return { items, nextCursor };
-  },
-});
-
-/**
- * Accept a pending invitation.
- *
- * Marks the invite as "accepted" and records the acceptance timestamp.
- * Throws a structured `ConvexError` when the invite doesn't exist or is not
- * currently pending.
- *
- * The caller is responsible for creating the corresponding member record.
- */
-export const inviteAccept = mutation({
-  args: {
-    inviteId: v.id("invite"),
-    acceptedByUserId: v.optional(v.id("user")),
-  },
-  handler: async (ctx, { inviteId, acceptedByUserId }) => {
-    const invite = await ctx.db.get(inviteId);
-    if (invite === null) {
-      throw new ConvexError({
-        code: "INVITE_NOT_FOUND",
-        message: "Invite not found",
-        inviteId,
-      });
-    }
-    if (invite.status !== "pending") {
-      throw new ConvexError({
-        code: "INVITE_NOT_PENDING",
-        message: `Cannot accept invite with status "${invite.status}"`,
-        inviteId,
-        currentStatus: invite.status,
-      });
-    }
-    await ctx.db.patch(inviteId, {
-      status: "accepted",
-      acceptedTime: Date.now(),
-      ...(acceptedByUserId ? { acceptedByUserId } : {}),
-    });
-  },
-});
-
-/**
- * Revoke a pending invitation.
- *
- * Marks the invite as "revoked". Throws a structured `ConvexError` when the
- * invite doesn't exist or is not currently pending.
- */
-export const inviteRevoke = mutation({
-  args: { inviteId: v.id("invite") },
-  handler: async (ctx, { inviteId }) => {
-    const invite = await ctx.db.get(inviteId);
-    if (invite === null) {
-      throw new ConvexError({
-        code: "INVITE_NOT_FOUND",
-        message: "Invite not found",
-        inviteId,
-      });
-    }
-    if (invite.status !== "pending") {
-      throw new ConvexError({
-        code: "INVITE_NOT_PENDING",
-        message: `Cannot revoke invite with status "${invite.status}"`,
-        inviteId,
-        currentStatus: invite.status,
-      });
-    }
-    await ctx.db.patch(inviteId, { status: "revoked" });
-  },
-});
-
-// ============================================================================
-// API Keys
-// ============================================================================
-
-/**
- * Insert a new API key record.
- *
- * The caller is responsible for hashing the raw key before passing it here —
- * this function only stores the hash and metadata.
- */
-export const keyInsert = mutation({
-  args: {
-    userId: v.id("user"),
-    prefix: v.string(),
-    hashedKey: v.string(),
-    name: v.string(),
-    scopes: v.array(
-      v.object({
-        resource: v.string(),
-        actions: v.array(v.string()),
-      }),
-    ),
-    rateLimit: v.optional(
-      v.object({
-        maxRequests: v.number(),
-        windowMs: v.number(),
-      }),
-    ),
-    expiresAt: v.optional(v.number()),
-  },
-  handler: async (ctx, args) => {
-    return await ctx.db.insert("key", {
-      ...args,
-      createdAt: Date.now(),
-      revoked: false,
-    });
-  },
-});
-
-/**
- * Look up an API key by its SHA-256 hash.
- *
- * Used during Bearer token verification. Returns the full key record
- * (including rate limit state) or `null` if not found.
- */
-export const keyGetByHashedKey = query({
-  args: { hashedKey: v.string() },
-  handler: async (ctx, { hashedKey }) => {
-    return await ctx.db
-      .query("key")
-      .withIndex("hashedKey", (q) => q.eq("hashedKey", hashedKey))
-      .first();
-  },
-});
-
-/**
- * @deprecated Use `keyList` with `where: { userId }` instead.
- * Kept for backward compatibility with generated component types.
- */
-export const keyListByUserId = query({
-  args: { userId: v.id("user") },
-  handler: async (ctx, { userId }) => {
-    return await ctx.db
-      .query("key")
-      .withIndex("userId", (q) => q.eq("userId", userId))
-      .collect();
-  },
-});
-
-/**
- * List API keys with optional filtering, sorting, and pagination.
- *
- * Returns `{ items, nextCursor }`. Supports filtering by `userId`,
- * `revoked`, `name`, and `prefix`.
- */
-export const keyList = query({
-  args: {
-    where: v.optional(
-      v.object({
-        userId: v.optional(v.id("user")),
-        revoked: v.optional(v.boolean()),
-        name: v.optional(v.string()),
-        prefix: v.optional(v.string()),
-      }),
-    ),
-    limit: v.optional(v.number()),
-    cursor: v.optional(v.union(v.string(), v.null())),
-    orderBy: v.optional(
-      v.union(
-        v.literal("_creationTime"),
-        v.literal("name"),
-        v.literal("lastUsedAt"),
-        v.literal("expiresAt"),
-        v.literal("revoked"),
-      ),
-    ),
-    order: v.optional(v.union(v.literal("asc"), v.literal("desc"))),
-  },
-  handler: async (ctx, args) => {
-    const where = args.where ?? {};
-    const limit = Math.min(Math.max(args.limit ?? 50, 1), 100);
-    const order = args.order ?? "desc";
-
-    let q;
-    if (where.userId !== undefined) {
-      q = ctx.db
-        .query("key")
-        .withIndex("userId", (idx) => idx.eq("userId", where.userId!));
-    } else {
-      q = ctx.db.query("key");
-    }
-
-    if (where.revoked !== undefined) {
-      q = q.filter((f) => f.eq(f.field("revoked"), where.revoked!));
-    }
-    if (where.name !== undefined) {
-      q = q.filter((f) => f.eq(f.field("name"), where.name!));
-    }
-    if (where.prefix !== undefined) {
-      q = q.filter((f) => f.eq(f.field("prefix"), where.prefix!));
-    }
-
-    q = q.order(order);
-
-    const all = await q.collect();
-    let startIdx = 0;
-    if (args.cursor) {
-      const cursorIdx = all.findIndex((doc) => doc._id === args.cursor);
-      if (cursorIdx !== -1) {
-        startIdx = cursorIdx + 1;
-      }
-    }
-    const page = all.slice(startIdx, startIdx + limit + 1);
-    const hasMore = page.length > limit;
-    const items = hasMore ? page.slice(0, limit) : page;
-    const nextCursor = hasMore ? items[items.length - 1]._id : null;
-    return { items, nextCursor };
-  },
-});
-
-/** Get a single API key by document ID. */
-export const keyGetById = query({
-  args: { keyId: v.id("key") },
-  handler: async (ctx, { keyId }) => {
-    return await ctx.db.get(keyId);
-  },
-});
-
-/**
- * Patch an API key record. Used for updating name, scopes, rate limit config,
- * revocation, and lastUsedAt / rate limit state tracking.
- */
-export const keyPatch = mutation({
-  args: {
-    keyId: v.id("key"),
-    data: v.object({
-      name: v.optional(v.string()),
-      scopes: v.optional(
-        v.array(
-          v.object({
-            resource: v.string(),
-            actions: v.array(v.string()),
-          }),
-        ),
-      ),
-      rateLimit: v.optional(
-        v.object({
-          maxRequests: v.number(),
-          windowMs: v.number(),
-        }),
-      ),
-      rateLimitState: v.optional(
-        v.object({
-          attemptsLeft: v.number(),
-          lastAttemptTime: v.number(),
-        }),
-      ),
-      revoked: v.optional(v.boolean()),
-      lastUsedAt: v.optional(v.number()),
-    }),
-  },
-  handler: async (ctx, { keyId, data }) => {
-    const key = await ctx.db.get(keyId);
-    if (key === null) {
-      throw new ConvexError({
-        code: "KEY_NOT_FOUND",
-        message: "API key not found",
-        keyId,
-      });
-    }
-    await ctx.db.patch(keyId, data);
-  },
-});
-
-/** Hard delete an API key record. */
-export const keyDelete = mutation({
-  args: { keyId: v.id("key") },
-  handler: async (ctx, { keyId }) => {
-    const key = await ctx.db.get(keyId);
-    if (key === null) {
-      throw new ConvexError({
-        code: "KEY_NOT_FOUND",
-        message: "API key not found",
-        keyId,
-      });
-    }
-    await ctx.db.delete(keyId);
-  },
-});
-
-// ============================================================================
-// Device Authorization (RFC 8628)
-// ============================================================================
-
-/** Insert a new device authorization record. */
-export const deviceInsert = mutation({
-  args: {
-    deviceCodeHash: v.string(),
-    userCode: v.string(),
-    expiresAt: v.number(),
-    interval: v.number(),
-    status: v.union(
-      v.literal("pending"),
-      v.literal("authorized"),
-      v.literal("denied"),
-    ),
-  },
-  handler: async (ctx, args) => {
-    return await ctx.db.insert("device", args);
-  },
-});
-
-/** Look up a device authorization by its hashed device code. */
-export const deviceGetByCodeHash = query({
-  args: { deviceCodeHash: v.string() },
-  handler: async (ctx, { deviceCodeHash }) => {
-    return await ctx.db
-      .query("device")
-      .withIndex("deviceCodeHash", (q) => q.eq("deviceCodeHash", deviceCodeHash))
-      .first();
-  },
-});
-
-/** Look up a pending device authorization by its user code. */
-export const deviceGetByUserCode = query({
-  args: { userCode: v.string() },
-  handler: async (ctx, { userCode }) => {
-    return await ctx.db
-      .query("device")
-      .withIndex("userCode", (q) =>
-        q.eq("userCode", userCode).eq("status", "pending"),
-      )
-      .first();
-  },
-});
-
-/** Authorize a device code — link it to a user and session. */
-export const deviceAuthorize = mutation({
-  args: {
-    deviceId: v.id("device"),
-    userId: v.id("user"),
-    sessionId: v.id("session"),
-  },
-  handler: async (ctx, { deviceId, userId, sessionId }) => {
-    await ctx.db.patch(deviceId, {
-      status: "authorized",
-      userId,
-      sessionId,
-    });
-  },
-});
-
-/** Update the last-polled timestamp on a device authorization record. */
-export const deviceUpdateLastPolled = mutation({
-  args: { deviceId: v.id("device"), lastPolledAt: v.number() },
-  handler: async (ctx, { deviceId, lastPolledAt }) => {
-    await ctx.db.patch(deviceId, { lastPolledAt });
-  },
-});
-
-/** Delete a device authorization record (cleanup after use or expiry). */
-export const deviceDelete = mutation({
-  args: { deviceId: v.id("device") },
-  handler: async (ctx, { deviceId }) => {
-    await ctx.db.delete(deviceId);
-  },
-});
+ * Flat public component namespace for `components.auth.public.*` references.
+ *
+ * The implementation files under `./public/**` stay grouped by domain for
+ * maintainability, while this module preserves the single flat component API
+ * surface consumed by the auth runtime and app code.
+ */
+export * from "./public/identity/accounts";
+export * from "./public/factors/devices";
+export * from "./public/enterprise/audit";
+export * from "./public/enterprise/core";
+export * from "./public/enterprise/domains";
+export * from "./public/enterprise/scim";
+export * from "./public/enterprise/secrets";
+export * from "./public/enterprise/webhooks";
+export * from "./public/groups/core";
+export * from "./public/groups/invites";
+export * from "./public/groups/members";
+export * from "./public/security/keys";
+export * from "./public/factors/passkeys";
+export * from "./public/security/limits";
+export * from "./public/identity/tokens";
+export * from "./public/identity/sessions";
+export * from "./public/factors/totp";
+export * from "./public/identity/users";
+export * from "./public/identity/codes";
+export * from "./public/identity/verifiers";